Uncontrolled Resource Consumption in spray-json

2018-11-0917:41:35

Google

osv.dev

0.002 Low

EPSS

Percentile

59.9%

JSON

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).

CPENameOperatorVersion
io.spray:spray-json_2.10eq1.3.4
io.spray:spray-json_2.10eq1.2.5
io.spray:spray-json_2.12eq1.3.3
io.spray:spray-json_2.12eq1.3.2
io.spray:spray-json_2.11eq1.3.3
io.spray:spray-json_2.11eq1.3.2
io.spray:spray-json_2.10eq1.3.1
io.spray:spray-json_2.10eq1.3.2
io.spray:spray-json_2.10eq1.3.3
io.spray:spray-json_2.12eq1.3.4

Name	Operator	Version
io.spray:spray-json_2.10	eq	1.3.4
io.spray:spray-json_2.10	eq	1.2.5
io.spray:spray-json_2.12	eq	1.3.3
io.spray:spray-json_2.12	eq	1.3.2
io.spray:spray-json_2.11	eq	1.3.3
io.spray:spray-json_2.11	eq	1.3.2
io.spray:spray-json_2.10	eq	1.3.1
io.spray:spray-json_2.10	eq	1.3.2
io.spray:spray-json_2.10	eq	1.3.3
io.spray:spray-json_2.12	eq	1.3.4